forked from LaconicNetwork/kompose
added OpenShifts fork of Kubernetes
reason for this is that openshift/kubernetes backported k8s.io/kubernetes/pkg/securitycontextconstraints/util that is currently required by something that github.com/openshift/origin/pkg/deploy/api/v1 depends on
This commit is contained in:
Tomas Kral
+143
@@ -0,0 +1,143 @@
|
||||
// +build !ignore_autogenerated_openshift
|
||||
|
||||
// This file was autogenerated by deepcopy-gen. Do not edit it manually!
|
||||
|
||||
package api
|
||||
|
||||
import (
|
||||
api "k8s.io/kubernetes/pkg/api"
|
||||
unversioned "k8s.io/kubernetes/pkg/api/unversioned"
|
||||
conversion "k8s.io/kubernetes/pkg/conversion"
|
||||
)
|
||||
|
||||
func init() {
|
||||
if err := api.Scheme.AddGeneratedDeepCopyFuncs(
|
||||
DeepCopy_api_PodSecurityPolicyReview,
|
||||
DeepCopy_api_PodSecurityPolicyReviewSpec,
|
||||
DeepCopy_api_PodSecurityPolicyReviewStatus,
|
||||
DeepCopy_api_PodSecurityPolicySelfSubjectReview,
|
||||
DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec,
|
||||
DeepCopy_api_PodSecurityPolicySubjectReview,
|
||||
DeepCopy_api_PodSecurityPolicySubjectReviewSpec,
|
||||
DeepCopy_api_PodSecurityPolicySubjectReviewStatus,
|
||||
DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus,
|
||||
); err != nil {
|
||||
// if one of the deep copy functions is malformed, detect it immediately.
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicyReview(in PodSecurityPolicyReview, out *PodSecurityPolicyReview, c *conversion.Cloner) error {
|
||||
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicyReviewSpec(in.Spec, &out.Spec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicyReviewStatus(in.Status, &out.Status, c); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicyReviewSpec(in PodSecurityPolicyReviewSpec, out *PodSecurityPolicyReviewSpec, c *conversion.Cloner) error {
|
||||
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if in.ServiceAccountNames != nil {
|
||||
in, out := in.ServiceAccountNames, &out.ServiceAccountNames
|
||||
*out = make([]string, len(in))
|
||||
copy(*out, in)
|
||||
} else {
|
||||
out.ServiceAccountNames = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicyReviewStatus(in PodSecurityPolicyReviewStatus, out *PodSecurityPolicyReviewStatus, c *conversion.Cloner) error {
|
||||
if in.AllowedServiceAccounts != nil {
|
||||
in, out := in.AllowedServiceAccounts, &out.AllowedServiceAccounts
|
||||
*out = make([]ServiceAccountPodSecurityPolicyReviewStatus, len(in))
|
||||
for i := range in {
|
||||
if err := DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus(in[i], &(*out)[i], c); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
out.AllowedServiceAccounts = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicySelfSubjectReview(in PodSecurityPolicySelfSubjectReview, out *PodSecurityPolicySelfSubjectReview, c *conversion.Cloner) error {
|
||||
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec(in.Spec, &out.Spec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.Status, &out.Status, c); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec(in PodSecurityPolicySelfSubjectReviewSpec, out *PodSecurityPolicySelfSubjectReviewSpec, c *conversion.Cloner) error {
|
||||
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicySubjectReview(in PodSecurityPolicySubjectReview, out *PodSecurityPolicySubjectReview, c *conversion.Cloner) error {
|
||||
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicySubjectReviewSpec(in.Spec, &out.Spec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.Status, &out.Status, c); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicySubjectReviewSpec(in PodSecurityPolicySubjectReviewSpec, out *PodSecurityPolicySubjectReviewSpec, c *conversion.Cloner) error {
|
||||
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
out.User = in.User
|
||||
if in.Groups != nil {
|
||||
in, out := in.Groups, &out.Groups
|
||||
*out = make([]string, len(in))
|
||||
copy(*out, in)
|
||||
} else {
|
||||
out.Groups = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in PodSecurityPolicySubjectReviewStatus, out *PodSecurityPolicySubjectReviewStatus, c *conversion.Cloner) error {
|
||||
if in.AllowedBy != nil {
|
||||
in, out := in.AllowedBy, &out.AllowedBy
|
||||
*out = new(api.ObjectReference)
|
||||
if err := api.DeepCopy_api_ObjectReference(*in, *out, c); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
out.AllowedBy = nil
|
||||
}
|
||||
out.Reason = in.Reason
|
||||
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus(in ServiceAccountPodSecurityPolicyReviewStatus, out *ServiceAccountPodSecurityPolicyReviewStatus, c *conversion.Cloner) error {
|
||||
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.PodSecurityPolicySubjectReviewStatus, &out.PodSecurityPolicySubjectReviewStatus, c); err != nil {
|
||||
return err
|
||||
}
|
||||
out.Name = in.Name
|
||||
return nil
|
||||
}
|
||||
+43
@@ -0,0 +1,43 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"k8s.io/kubernetes/pkg/api/unversioned"
|
||||
"k8s.io/kubernetes/pkg/runtime"
|
||||
)
|
||||
|
||||
const GroupName = ""
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = unversioned.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
|
||||
|
||||
// Kind takes an unqualified kind and returns back a Group qualified GroupKind
|
||||
func Kind(kind string) unversioned.GroupKind {
|
||||
return SchemeGroupVersion.WithKind(kind).GroupKind()
|
||||
}
|
||||
|
||||
// Resource takes an unqualified resource and returns back a Group qualified GroupResource
|
||||
func Resource(resource string) unversioned.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
func AddToScheme(scheme *runtime.Scheme) {
|
||||
// Add the API to Scheme.
|
||||
addKnownTypes(scheme)
|
||||
}
|
||||
|
||||
// Adds the list of known types to api.Scheme.
|
||||
func addKnownTypes(scheme *runtime.Scheme) {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&PodSecurityPolicySubjectReview{},
|
||||
&PodSecurityPolicySelfSubjectReview{},
|
||||
&PodSecurityPolicyReview{},
|
||||
)
|
||||
}
|
||||
|
||||
func (obj *PodSecurityPolicySubjectReview) GetObjectKind() unversioned.ObjectKind {
|
||||
return &obj.TypeMeta
|
||||
}
|
||||
func (obj *PodSecurityPolicySelfSubjectReview) GetObjectKind() unversioned.ObjectKind {
|
||||
return &obj.TypeMeta
|
||||
}
|
||||
func (obj *PodSecurityPolicyReview) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
|
||||
+107
@@ -0,0 +1,107 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
kapi "k8s.io/kubernetes/pkg/api"
|
||||
"k8s.io/kubernetes/pkg/api/unversioned"
|
||||
)
|
||||
|
||||
// +genclient=true
|
||||
|
||||
// PodSecurityPolicySubjectReview checks whether a particular user/SA tuple can create the PodSpec.
|
||||
type PodSecurityPolicySubjectReview struct {
|
||||
unversioned.TypeMeta
|
||||
|
||||
// Spec defines specification for the PodSecurityPolicySubjectReview.
|
||||
Spec PodSecurityPolicySubjectReviewSpec
|
||||
|
||||
// Status represents the current information/status for the PodSecurityPolicySubjectReview.
|
||||
Status PodSecurityPolicySubjectReviewStatus
|
||||
}
|
||||
|
||||
// PodSecurityPolicySubjectReviewSpec defines specification for PodSecurityPolicySubjectReview
|
||||
type PodSecurityPolicySubjectReviewSpec struct {
|
||||
// PodSpec is the PodSpec to check. If PodSpec.ServiceAccountName is empty it will not be defaulted.
|
||||
// If its non-empty, it will be checked.
|
||||
PodSpec kapi.PodSpec
|
||||
|
||||
// User is the user you're testing for.
|
||||
// If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups.
|
||||
// If User and Groups are empty, then the check is performed using *only* the ServiceAccountName in the PodSpec.
|
||||
User string
|
||||
|
||||
// Groups is the groups you're testing for.
|
||||
Groups []string
|
||||
}
|
||||
|
||||
// PodSecurityPolicySubjectReviewStatus contains information/status for PodSecurityPolicySubjectReview.
|
||||
type PodSecurityPolicySubjectReviewStatus struct {
|
||||
// AllowedBy is a reference to the rule that allows the PodSpec.
|
||||
// A rule can be a SecurityContextConstraint or a PodSecurityPolicy
|
||||
// A `nil`, indicates that it was denied.
|
||||
AllowedBy *kapi.ObjectReference
|
||||
|
||||
// A machine-readable description of why this operation is in the
|
||||
// "Failure" status. If this value is empty there
|
||||
// is no information available.
|
||||
Reason string
|
||||
|
||||
// PodSpec is the PodSpec after the defaulting is applied.
|
||||
PodSpec kapi.PodSpec
|
||||
}
|
||||
|
||||
// PodSecurityPolicySelfSubjectReview checks whether this user/SA tuple can create the PodSpec.
|
||||
type PodSecurityPolicySelfSubjectReview struct {
|
||||
unversioned.TypeMeta
|
||||
|
||||
// Spec defines specification the PodSecurityPolicySelfSubjectReview.
|
||||
Spec PodSecurityPolicySelfSubjectReviewSpec
|
||||
|
||||
// Status represents the current information/status for the PodSecurityPolicySelfSubjectReview.
|
||||
Status PodSecurityPolicySubjectReviewStatus
|
||||
}
|
||||
|
||||
// PodSecurityPolicySelfSubjectReviewSpec contains specification for PodSecurityPolicySelfSubjectReview.
|
||||
type PodSecurityPolicySelfSubjectReviewSpec struct {
|
||||
// PodSpec is the PodSpec to check.
|
||||
PodSpec kapi.PodSpec
|
||||
}
|
||||
|
||||
// PodSecurityPolicyReview checks which service accounts (not users, since that would be cluster-wide) can create the `PodSpec` in question.
|
||||
type PodSecurityPolicyReview struct {
|
||||
unversioned.TypeMeta
|
||||
|
||||
// Spec is the PodSecurityPolicy to check.
|
||||
Spec PodSecurityPolicyReviewSpec
|
||||
|
||||
// Status represents the current information/status for the PodSecurityPolicyReview.
|
||||
Status PodSecurityPolicyReviewStatus
|
||||
}
|
||||
|
||||
// PodSecurityPolicyReviewSpec defines specification for PodSecurityPolicyReview
|
||||
type PodSecurityPolicyReviewSpec struct {
|
||||
// PodSpec is the PodSpec to check. The PodSpec.ServiceAccountName field is used
|
||||
// if ServiceAccountNames is empty, unless the PodSpec.ServiceAccountName is empty,
|
||||
// in which case "default" is used.
|
||||
// If ServiceAccountNames is specified, PodSpec.ServiceAccountName is ignored.
|
||||
PodSpec kapi.PodSpec
|
||||
|
||||
// ServiceAccountNames is an optional set of ServiceAccounts to run the check with.
|
||||
// If ServiceAccountNames is empty, the PodSpec ServiceAccountName is used,
|
||||
// unless it's empty, in which case "default" is used instead.
|
||||
// If ServiceAccountNames is specified, PodSpec ServiceAccountName is ignored.
|
||||
ServiceAccountNames []string // TODO: find a way to express 'all service accounts'
|
||||
}
|
||||
|
||||
// PodSecurityPolicyReviewStatus represents the status of PodSecurityPolicyReview.
|
||||
type PodSecurityPolicyReviewStatus struct {
|
||||
// AllowedServiceAccounts returns the list of service accounts in *this* namespace that have the power to create the PodSpec.
|
||||
AllowedServiceAccounts []ServiceAccountPodSecurityPolicyReviewStatus
|
||||
}
|
||||
|
||||
// ServiceAccountPodSecurityPolicyReviewStatus represents ServiceAccount name and related review status
|
||||
type ServiceAccountPodSecurityPolicyReviewStatus struct {
|
||||
PodSecurityPolicySubjectReviewStatus
|
||||
|
||||
// Name contains the allowed and the denied ServiceAccount name
|
||||
Name string
|
||||
}
|
||||
Reference in New Issue
Block a user